What it is
The GitHub MCP Server is GitHub's official server for connecting AI agents to GitHub. It replaced the reference GitHub server, which the MCP project has archived. Agents can search code, open and review pull requests, manage issues, read Actions runs and logs, and query code scanning, Dependabot and secret scanning alerts.
The hosted endpoint at https://api.githubcopilot.com/mcp/ signs you in with OAuth. The same Go code runs locally as a Docker image (ghcr.io/github/github-mcp-server) or a binary, with OAuth or a personal access token. Version 2.0.3 shipped on 21 October 2026; 2.0.0 added typed outputs for clients that support code-mode tool calling.
Tools are grouped into 22 toolsets. Only context, repos, issues, pull_requests and users load by default, and the remote server adds Copilot coding agent, Copilot Spaces and a GitHub support-docs search.
Install
https://api.githubcopilot.com/mcp/Our review
This is the GitHub server to use, and the reasons are control as much as coverage. The README documents 93 tools in the local build, and loading them all would crowd any model's context, so only five toolsets switch on by default. You can add toolsets with --toolsets or GITHUB_TOOLSETS, name individual tools with --tools, or set --read-only, which wins even over tools you asked for by name.
The hosted endpoint suits most people. GitHub's docs say it is available to all users regardless of plan, but organisations on Copilot Business or Enterprise must enable the "MCP servers in Copilot" policy before Copilot editors can reach it. Third-party hosts such as Claude and Cursor are governed instead by OAuth app, GitHub App and PAT policies, plus SSO. Enterprise Cloud with data residency (ghe.com) can use a hosted endpoint on its own subdomain; Enterprise Server cannot, and has to run the server locally.
Security is where the documentation is most useful. Issues, comments and commit messages on public repositories are untrusted text, and lockdown mode filters content from authors without push access. GitHub states plainly that it is a best-effort filter and not an authorisation boundary: the credential can still do whatever it is scoped for. Two advisories have been published this year, a medium-severity bug where the HTTP server's lockdown singleton mixed up GraphQL clients between users (June) and a high-severity crash in the completion handler (July). The first was patched in 1.1.2; the second advisory lists no patched version.
Rate limits come from the REST API, not the server. A personal token gets 5,000 requests an hour, and the secondary limit of 80 content-creating requests a minute is the one a busy triage agent is likelier to meet. The local git server is lighter for working on a checked-out repo, but it cannot see anything that lives only on GitHub.
Where it earns its place
A maintainer of a public open-source library with 300 open issues
Label and summarise new issues each morning without acting on spam or injected instructions
Runs the server with --toolsets issues,labels and --lockdown-mode so text from accounts without push access is withheld. A fine-grained token limited to issue writes keeps a misled agent from touching code; the job stays well inside 5,000 API requests an hour.
A backend engineer on a ten-person team using Claude Code
Find why last night's Actions run failed and open a pull request with the fix
Adds the actions toolset to the defaults, so the agent can read the failed job's logs, edit files through the repos tools and open a pull request. The cost is the team's existing GitHub plan; the risk is a token with push rights, so branch protection still matters.
An engineering manager at a 60-developer company on Copilot Business
Let developers use the GitHub server in VS Code without opening it to every third-party tool
An org admin enables the "MCP servers in Copilot" policy for Copilot editors and separately restricts OAuth app access for third-party hosts. No extra licence is needed for the server itself; underlying API calls appear in the audit log.
Before you commit
- Setup
- Add https://api.githubcopilot.com/mcp/ to VS Code 1.101+, Claude Desktop, Cursor or Windsurf and sign in with OAuth on first call; or run the Docker image, which publishes a login callback on 127.0.0.1:8085.
- Integrations
- 93 local tools across 22 toolsets, including issue_read, pull_request_read, create_pull_request, search_code and Actions log tools; the remote server adds create_pull_request_with_copilot and Copilot Spaces.
- Data and privacy
- The server can read and write whatever the OAuth grant or token allows, and the hosted version runs on GitHub's infrastructure. Issue and PR text is untrusted input; GitHub published two advisories for the server in 2026, one medium and one high severity.
- Cost at scale
- Free. Agents spend your REST quota: 5,000 requests an hour per user token, 15,000 for apps owned by an Enterprise Cloud organisation, with secondary caps of 80 content-creating requests a minute and 500 an hour.
- Limits
- No hosted endpoint for Enterprise Server; typed outputs only reach clients on the 2026-07-28 MCP spec or later; enabling --toolsets all puts all 93 tool definitions in context.
What's good
- Published by GitHub, with releases every few weeks
- Hosted endpoint with OAuth, or self-run via Docker or binary
- Toolsets, per-tool selection and a read-only flag
- Lockdown mode for public-repo prompt-injection risk
What's not
- 93 tools if you enable everything, which crowds context
- No hosted option for GitHub Enterprise Server
- Lockdown is a content filter, not a permission limit
- Copilot-specific tools need a paid Copilot licence
Best for
Developers and platform teams who want agents working on GitHub issues, pull requests and CI with scoped credentials.
Alternatives
GitHub MCP Server: common questions
- Is GitHub MCP Server worth it?
- GitHub access for agents should come from GitHub itself, and this server earns that with toolsets, read-only mode and a frank account of what lockdown cannot do. We rate it 4.7 out of 5.
- How much does GitHub MCP Server cost?
- Free and MIT-licensed, hosted or self-run, on any GitHub plan. Tools for paid features (Copilot coding agent, some security alerts) need those licences.
- What are the downsides of GitHub MCP Server?
- 93 tools if you enable everything, which crowds context; no hosted option for GitHub Enterprise Server; lockdown is a content filter, not a permission limit; copilot-specific tools need a paid Copilot licence.
- Who is GitHub MCP Server best for?
- Developers and platform teams who want agents working on GitHub issues, pull requests and CI with scoped credentials.
- How much does GitHub MCP Server cost for a team or in production?
- Free. Agents spend your REST quota: 5,000 requests an hour per user token, 15,000 for apps owned by an Enterprise Cloud organisation, with secondary caps of 80 content-creating requests a minute and 500 an hour.
- Is GitHub MCP Server safe for company data?
- The server can read and write whatever the OAuth grant or token allows, and the hosted version runs on GitHub's infrastructure. Issue and PR text is untrusted input; GitHub published two advisories for the server in 2026, one medium and one high severity.
- What are the best GitHub MCP Server alternatives?
- The closest alternatives we have reviewed are Git (reference server) and Sentry MCP.
Answers checked Oct 22, 2026.
Make GitHub MCP Server? Show this rating on your site
